registry / @machinen/runtime / 0.8.6

@machinen/runtime@0.8.6

The TypeScript API behind machinen. Reach for this when you want to drive microVMs from your own Node.js code instead of through the CLI.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

On an explicit VM boot, missing `gvproxy` is fetched, persisted, made executable, and launched. This is a package-aligned networking helper, but its remote executable is not integrity-verified.

Static reason

One or more suspicious static signals were detected.

Trigger

Caller invokes `boot()` without an available or disabled `gvproxy`.

Impact

A compromised release delivery path could execute code as the invoking user.

Mechanism

Runtime download and execution of a fixed GitHub release binary.

Rationale

No malicious install hook, credential harvesting, exfiltration, stealth persistence, or AI-agent control-surface modification was found. The unverified runtime binary download-and-execute chain is a real supply-chain risk that warrants warning rather than a block.

Evidence

package.jsondist/index.jsAPI.md~/.machinen/gvproxy/v0.8.6/gvproxy~/.machinen/gvproxy/v0.8.6/gvproxy.lock/tmp/mgv-*

Network endpoints1

github.com

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

@machinen/runtime@0.8.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code